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Office Action Summary 



Application No. 

09/660,300 



Examiner 

Ali M. Mashaal 



Applicant(s) 
SMITHSON ET AL. 



Art Unit 



2136 



is/are withdrawn from consideration. 



^SHORTENED STATUTORY PE R ,OD FOR REPLY « SET TO EXP,RE , MONTH(S) PROM 
THE MAILING DATE OF THIS COMMUINICATraN.^^ ^ ^ ^ may a reply be fimely flled 

earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )M Responsive to communication(s) filed on 1? September 2000 . 
■— , l- ■ r, U Ai 2b^ This action is non-final. 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 453 O.G. 213. 

Disposition of Claims 

4) gl Claim(s) ±36 is/are pending in the application. 
4a) Of the above claim(s) 

5) D Claim(s) is/are allowed. 

6) I3 Claim (s) ±36 is/are rejected. 

7) D Claim(s) is/are objected to. 

8 ) D ciaim(s) are subject to restriction and/or election requirement. 

Application Papers 

Applicant may not request that any objection to the drawing(s) be held ,n abeyance. See 37 CFR 1 .85(a). 

Priority under 35 U.S.C. § 119 

«)□ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)D All b)D Some *c)D None of: 

1D certified copies of the priority documents have been received. 

2 Q Certified copies of the priority documents have been received in Appl.cat.on No 

L - 1 ^~..m^n+c hfl\/P hpm received in tr 



application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not rece.ved. 



Attachment(s) 

1) Notice of References Cited (PTO-892) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 
Paper No(s)/Mail Date . 



4) □ Interview Summary (PTO-413) 

Paper No(s)/Mail Date. ■ 

5) □ Notice of Informal Patent Application (PTO-152) 

6) [Zl Other: . 
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DETAILED ACTION 

1 ) This action is in response to communication filed 09/1 2/2000. 

2) Claims 1 -36 are currently under examination. 

Claim Rejections ■ 35 USC § 103 

3) The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3.1) Claims 1, 6-7, 13, 18-19, 25 and 30-31 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over US Patent No. 5,278,901 to Shieh et al. (Shieh), in view of US 
Patent No. 5,440,723 to Arnold et al. (Arnold). 

As per claims 1,13, and 25, Shieh teaches a computer program product/method 
for detecting an outbreak of a virus on a computer apparatus, said computer program 
product/method comprising: 

(i) measuring one or more measurement parameters indicative of non-virus 
specific activity of said computer apparatus over a respective measurement period, see 

col. 17, lines 17-30. 

(ii) comparing said one or more measurement parameters with respective 
predetermined threshold levels, see col. 17, lines 17-30. 
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Shieh fails to explicitly disclose (iii) generating a signal indicative of an outbreak 
of a computer virus if one or more of said one or more measurement parameters 
crosses a respective predetermined threshold level. 

However, Arnold in an analogous art, teaches this limitation, see col. 22, lines 
62-68, and col. 24, lines 12-15. It would have been obvious to one having ordinary skill 
in the art at the time the invention was made to combine the feature of sending an alert 
upon possible detection of a virus as taught by Arnold with the event that some 
thresholds were breached in the Shieh invention. One would have been motivated to 
do so because an alert would notify the user/administrator of the system, so that correct 
action could be taken to remedy the possible virus problem. 

As per claims 6, 18, and 30, Shieh further teaches wherein one of said 
measurement parameters is e-mail throughput within said computer system, see col. 4, 
lines 45-59, in which Shieh teaches pattern-oriented Intrusion detection, which helps 
define patterns of object privilege and data flows that characterize operational security 
problems in otherwise secure systems. 

As per claim 7, 19, and 31 , examiner respectfully asserts that it is well known in 
the art that in order to calculate throughput of e-mails, one would multiply the number of 
emails by the total size. 



3.2) Claims 2-5, 14-17, and 26-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over US Patent No. 5,278,901 to Shieh et al. (Shieh), in view of US Patent 
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No. 5,440,723 to Arnold et al. (Arnold) as applied to the base claims, and further in view 
of US Patent No. 5,832,208 to Chen et al. (Chen). 

As per claims 2-5, 14-17, and 26-29, the Shieh-Arnold combination teaches all 
limitations of the base claims, but fails to explicitly teach wherein one of said 
measurement parameters is how many e-mail messages are sent having an identical 
message title/file attachment/attachment of a given file type. Shieh however does teach 
in regards to detecting/preventing an unknown virus from propagating, monitoring its 
pattern according to his teaching based on several threshold parameters. Shieh further 
teaches that these parameters are used for "defining limits to determine abnormal 
process behavior." See col. 1 7, lines 1 7-30. 

Chen in an analogous art teaches that e-mail attachments are of particular 
concern in relation to the transmission of computer viruses. Chen further mentions that 
these attachments may contain executable files. Chen also teaches that an attachment 
to an email message may contain a file infected with a computer virus. Chen says that 
an email having a virus attachment may be broadcast over a network. In light of this 
teaching of Chen it would have been obvious to one having ordinary skill in the art at the 
time the invention was made to include as parameters in the Shieh-Arnold combination, 
threshold parameters such as those taught by Chen. Namely, because Chen teaches 
the danger of email attachments in association with viruses, and specifically teaches 
that should an email be broadcast, it may infect multiple recipients, it would have been 
obvious to one having ordinary skill in the art to monitor all characteristics of a 
broadcast email. Specifically these threshold parameters would include email subject 
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line s.ceabroaacas.e.aawou^ave.hesa.esubieo.nne. Similany these 
type One would have been motivated* do so because Chen teaches that email 
type of email activity. See col. 3, lines 17-32. 

33) cairns 8-0, 20-21 . and 3,33 a, reiected undo, 35 U.S.C. 103(a) as being 

No . 5,440,723, Arnoid etai. (Arnold)as applied tothe base claims, and further ,n v,ew 
of US Patent No. 5,1 24,943 to Ubarsky. 

* per claims 8-9, 20-21 , and 32-33, the Shieh-Arnoid combination teaches a„ 
, imrt a,ions of the base claims, but fails to explicitly disclose said respective 
predeterminedthresholdleveis are varied in dependence upontime of day,day ofwee, 

trafflc onanetworKvariesfrom day today and a, dtferen, times of the da, Seecol. 
aUhetimethe invention was made to set different (i.e. lower, thresholds during off-peaK 

normal for a given instance. 
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34, C, a i m s10.12,2 2 . 2 4,and34-36a r ere ie cte d under35 U .S.C.103(a)as b e i n g 
unpatentable over US Patent No. 5,278,901 to Shieh et al. (Shieh), in view of US Patent 
No . 5 , 44 0,23to Arnold etal. (Arnolds applied tothebase claims, and furthe ew 

of US Patent No. 5956,481 to Walsh et al. (Walsh). 

A s per claims, 10-12, 22-24, and 34-36, the Shieh-Arnold combination teaches 

viru s protection system/method/software program .re user deflnabie/seleCable, 
However, Walsh in an analogous art adequately discloses user selectable features 
wit hin a virus-protection software, see col. 3, lines 20-41 . ,« would have been obvious to 

feat ures that are available in the Shieh-Arnold combination user-selectable as taught by 

versatility to the software, ma.ng it specialized for any given consumer, maKing the 
product more marketable. 



Conclusion 

The prior art made of record and no. relied upon is considered pertinent to 

applicant's disclosure. 

The following is a list of pertinent prior art: 

US005440723A 
US005278901A 
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US006016546A 
US 20040054498A1 
US005832208A 
US005956481A 
US05124943A 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to AH M. Mashaal whose telephone number is 703-305- 
7854. The examiner can normally be reached on 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 703-305-9648. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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